Osama Hamad 。

Somehow under control

[Osama Hamad 。 @about_testing]

i think this is good

[Osama Hamad 。 @about_testing]

Nice @Hacker0x01

[Osama Hamad 。 @about_testing]

@TimHaines @brave @Hacker0x01 @bcrypt This program not worth spending a min on,

[Osama Hamad 。 @about_testing]

In the original Buddhist scriptures (the Pali Canon), the Buddha explicitly rejected fatalism (Niyati) and the belief that a creator god dictates human life. Instead, he taught the law of Karma (cause and effect), which places absolute responsibility onto the individual.

.

[Akshay 🚀 @akshay_pachaar]

Google just open-sourced Harness².

(turn any harness into a self-improving system)

a harness is everything wrapped around the model, like the system prompt, tools, memory, skills, and subagents. today a person designs it once, and the agent runs every new task with that same fixed setup.

Harness² lets the agent refine that setup for each new task on its own, with the model weights left untouched.

on every task, the agent proposes edits to its harness, runs a few candidate versions, and composes a better harness by comparing how those runs behaved.

because it learns from the differences between runs, it needs no correct answer or grader for the task.

that covers a single task. Harness² also carries what it learns from one task into the next.

after each task, it saves the harness it settled on along with the lessons that held up across the runs. the next time it refines a harness, it starts from those notes instead of from scratch.

this means every finished task makes the next round of edits more informed.

Google tested this with Gemini 3.5 Flash and GLM-5 on legal, office, and professional work benchmarks. one round of edits was enough to beat their original harnesses, and giving the agent more rounds pushed scores higher.

those extra rounds can go wide or deep. the agent either tries several candidate harnesses at once or keeps refining a single one step by step, using OpenCode or Codex to carry out the work.

you can find the Harness² repo here: https://t.co/i00WLeeFpw

I wrote about a similar idea for agents already running in production, where the harness should repair itself after a failure instead of waiting for someone to debug the trace by hand.

that piece walks through how @Cometml's Opik (open-source) closes this loop, going from a failing trace to a proposed fix to a regression test that stops the same failure from coming back. it's quoted below.

[Raunak Gupta @OreoB1scuit]

new era site for reading top bug bounty writeups

https://t.co/f2nMSX8AWy

[Geekboy @emgeekboy]

Open models make it easier to experiment and push security research forward. But once we give them access to our tools, code and credentials, where the weights come from matters a lot more.

Our team planted a backdoor in a model and ran it inside a coding agent. It behaved normally until a trigger made it run a shell command and send test credentials to a server we controlled. So before you download a fine-tune and start building, check where the weights come from. Models are part of our software supply chain now, and deserve the same care as software dependencies.

Full research from our team:
https://t.co/gkIBvcDcET

[Osama Hamad 。 @about_testing]

@mdp_sec @Bugcrowd i never saw bugcrowd better than h1 in anything although h1 have its chunk of issues

[Osama Hamad 。 @about_testing]

just got duplicate on a triaged finding and its original reporter didn't get paid since oct 2025, aint gonna spend 1 more token on this program no more,
the new h1 agent related to marking reports as dups looks great

[Osama Hamad 。 @about_testing]

@mdp_sec nice work , thanks

[OrcaRouter 🐳 @OrcaRouter]

Anthropic just sounded the alarm on GLM-5.3’s cyber capabilities.

We built on it. OrcaCyber Zero 1.0 is based on the GLM-5.3, post-trained specifically for vulnerability research, exploit reproduction, red teaming, and autonomous cyber workflows.

98.01% pass@1 on CyberGym L1.
1,478 / 1,507 real-world vulnerability tasks.
The cyber model race is here.

And open models are moving fast.

Join private testing: https://t.co/9b9T6pORTT

[Osama Hamad 。 @about_testing]

Idk if u look at it from different perspectives, it looks shady, some programs require researchers to pay to submit, also from business perspective i think having a bb program with a bunch of creative researchers using AI is cheaper, maybe less maintenance and more valuable than having mythos ..etc
Look at curl for example the most audited codebase after mythos ppl still poping cves

[Google VRP (Google Bug Hunters) @GoogleVRP]

Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.

How it works: https://t.co/n3k4vvNhoq

For real-world vulnerabilities PageBreak has discovered 👇

https://t.co/0pZ5rWoWw2

[Osama Hamad 。 @about_testing]

@mdp_sec @ollama U used glm latest before for security , pentest , bb hunting what do u think about it ?

[Osama Hamad 。 @about_testing]

@ott3rly always has been

[pwn.ai @pwn_ai]

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

https://t.co/91D2F2lSdb